OpenNHP/opennhp · error

failed to get evidence from CC or agent uuid

Error message

failed to get evidence from CC or agent uuid

What it means

GetEvidence tries to obtain evidence first via GetEvidenceWithCCUrl, then falls back to GetEvidenceWithAgentUuid. If both paths fail, it returns this generic error with no underlying detail, losing the root cause. It means the environment provides neither a working confidential-computing evidence source nor a usable agent uuid.

Solutions

1. Verify the confidential-computing (CC) URL configuration so GetEvidenceWithCCUrl succeeds
2. Ensure the agent unique id is properly provided to the WASM host so GetEvidenceWithAgentUuid works
3. Improve the error by wrapping both underlying errors: fmt.Errorf("failed to get evidence from CC or agent uuid: %w; %w", ccErr, agentErr)

Example fix

// before
if err != nil {
	return "", fmt.Errorf("failed to get evidence from CC or agent uuid")
}
// after
if err != nil {
	return "", fmt.Errorf("failed to get evidence from CC or agent uuid: %w", err)
}

if ccUrl == "" && agentUniqueId == "" {
	// neither evidence source is configured; fail fast before calling GetEvidence
}

ev, err := GetEvidence()
if err != nil {
	if strings.Contains(err.Error(), "failed to get evidence") {
		// check CC URL config and agent uuid availability, then retry
	}
}

When it happens

Trigger: GetEvidenceWithCCUrl errors (e.g. CC URL unset or unreachable) AND GetEvidenceWithAgentUuid also errors (e.g. agent unique id unavailable), when called from GetEvidence (nhp/core/wasm/engine/host.go:102).

Common situations: WASM module running outside a confidential-computing environment without the CC URL env/config; agent unique id not injected by the host; misconfigured deployment missing both evidence sources.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

• unsupported key type, expect RSA
• JWT signing key is not initialized
• TEE public key is not found for specified token
• invalid n
• invalid e

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/8e1de15427515bc3. Report an issue: GitHub.

Appendix: source

Thrown at nhp/core/wasm/engine/host.go:102

	}

	var buf bytes.Buffer
	w := zlib.NewWriter(&buf)
	_, err = w.Write(evidenceBytes)
	w.Close()
	if err != nil {
		return nil, fmt.Errorf("failed to compress response body: %w", err)
	}

	return buf.Bytes(), nil
}

func GetEvidence() (string, error) {
	evidence, err := GetEvidenceWithCCUrl()
	if err != nil {
		evidence, err = GetEvidenceWithAgentUuid()
		if err != nil {
			return "", fmt.Errorf("failed to get evidence from CC or agent uuid")
		}
	}

	return base64.StdEncoding.EncodeToString(evidence), nil
}

func CalculateAgentUniqueId() (string, error) {
	hostname, err := os.Hostname()
	if err != nil {
		return "", err
	}

	cgroup, _ := os.ReadFile("/proc/self/cgroup")
	combined := hostname + string(cgroup)
	sum := sha256.Sum256([]byte(combined))

	return hex.EncodeToString(sum[:]), nil
}

View on GitHub (pinned to 6e04ca5ff0)